Contract Bench, Incident Responder (DFIR)

The Role

This contract position involves conducting digital forensic investigations and incident response engagements on a flexible, as-needed basis. Responders analyse live response data, investigate threat actor activity across Windows environments and cloud platforms, and help eradicate adversaries across clients’ full digital footprints, including SaaS applications and public cloud infrastructure.

Skills & Experience

Candidates require deep hands-on experience in Windows forensics, a strong understanding of forensic artefacts, and familiarity with cloud-native investigations across AWS, Azure, and GCP. Experience identifying account takeovers, analysing SaaS logs, and working with custom forensic tooling and scripts is highly valued.

Who It Suits

This role suits experienced incident responders seeking flexible, part-time engagement rather than a full-time commitment. It is ideal for seasoned practitioners who remain passionate about live investigations and want to stay sharp on emerging threats without the demands of traditional on-call schedules or holiday disruptions.